diff options
| author | Song Liu <songliubraving@fb.com> | 2016-09-08 20:21:07 +0200 |
|---|---|---|
| committer | Jes Sorensen <Jes.Sorensen@redhat.com> | 2016-09-12 18:51:12 +0200 |
| commit | 474267015b492308d5f410e3568c6cb3d370c688 (patch) | |
| tree | 6d497dfb035898fb436c8722fc66a721ca060278 /super1.c | |
| parent | mdopen: Prevent overrunning the devname buffer when copying devnm into it for... (diff) | |
| download | mdadm-474267015b492308d5f410e3568c6cb3d370c688.tar.xz mdadm-474267015b492308d5f410e3568c6cb3d370c688.zip | |
mdadm: fix a buffer overflow
struct mdp_superblock_1.set_name is 32B long, but struct mdinfo.name
is 33B long. So we need strncpy instead strcpy to avoid buffer
overflow.
Signed-off-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
Diffstat (limited to 'super1.c')
| -rw-r--r-- | super1.c | 4 |
1 files changed, 2 insertions, 2 deletions
@@ -1294,7 +1294,7 @@ static int update_super1(struct supertype *st, struct mdinfo *info, strcat(sb->set_name, ":"); strcat(sb->set_name, info->name); } else - strcpy(sb->set_name, info->name); + strncpy(sb->set_name, info->name, sizeof(sb->set_name)); } else if (strcmp(update, "devicesize") == 0 && __le64_to_cpu(sb->super_offset) < __le64_to_cpu(sb->data_offset)) { @@ -1444,7 +1444,7 @@ static int init_super1(struct supertype *st, mdu_array_info_t *info, strcat(sb->set_name, ":"); strcat(sb->set_name, name); } else - strcpy(sb->set_name, name); + strncpy(sb->set_name, name, sizeof(sb->set_name)); sb->ctime = __cpu_to_le64((unsigned long long)time(0)); sb->level = __cpu_to_le32(info->level); |